Google Chrome on Android contains an insufficient input validation flaw in the Payments component, allowing a compromised renderer process to supply a crafted web page that changes the displayed Omnibox text. This defect lets an attacker make the browser appear to be showing a different URL than the page currently loaded, potentially misleading users into interacting with malicious content or credential theft. The weakness aligns with CWE‑20: Improper Input Validation. Inherited from the description, the vulnerability is categorized as a medium‑severity issue by Chromium.

The flaw affects all Android installations of Google Chrome versions prior to 148.0.7778.96, regardless of build channel or device model, as the root cause resides in the Payments code path executed by the renderer process.

The CVSS base score is medium and the EPSS score is not available, indicating no widely reported exploitation yet. The vulnerability requires a prior compromise of the renderer process, a high‑privilege component, which suggests that a direct attacker must first exploit another vulnerability or gain local shell access. Because the attack vector is limited to compromised renderer contexts and the flaw is not immediately exploitable from the network, the overall risk is moderate. The vulnerability is not listed in CISA KEV, further implying a low probability of active exploitation at this time. However, an attacker with renderer control could still deface the user interface, possibly leading to phishing or credential theft.